Shared Model
Shared responsibility literacy names the split — CSP secures the cloud, customer secures what's in the cloud — mapped on YOUR $CLOUD_LAB before any live assessment.
Visual · t31_shared_model
Shared model literacy. $CLOUD_LAB only. Original Cyberlium.
Nothing is 'fully managed' for security — literacy names who owns patching, IAM, and data exposure on accounts you control.
The shared responsibility model divides security duties: cloud providers secure physical infrastructure, hypervisors, and managed service foundations; customers secure identities, configurations, data classification, network rules, and application code. Misunderstanding the split causes the majority of cloud breaches — usually customer-side misconfig, not CSP datacenter failure. Cyberlium maps shared responsibility on YOUR $CLOUD_LAB sandbox — never assess stranger subscriptions without authorization. Next: CSP vs Customer.
1. Shared model layers (named)
CSP responsibility: physical security, regional resilience, managed control plane for services like S3 or Azure Blob foundations. Customer responsibility: IAM policies, bucket ACLs, encryption settings, VPC rules, logging enablement, and patch cadence for guest OS and apps.
On $CLOUD_LAB, write one sentence each for CSP vs customer duty on a fictional S3 bucket in your sandbox.
Command guide
Try these commands — Shared model layers (named)
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: python3, curl. Reference sites: AWS shared responsibility (https://aws.amazon.com/compliance/shared-responsibility-model/); Azure shared responsibility (https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility); NIST SP 800-144 (https://csrc.nist.gov/publications/detail/sp/800-144/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why the model beats 'the cloud is secure'
Marketing 'secure cloud' hides customer obligations — public buckets, open security groups, and stale keys remain YOUR fix. Compliance frameworks (CIS, SOC 2) map controls to this split; auditors ask who owns each control.
Students label responsibilities on lab notes before running hardening checklists on personal accounts.
3. Lab boundary
Forbidden: claiming CSP secures your data so bucket ACL review is optional. Allowed: shared model card — three CSP duties, three customer duties, one $CLOUD_LAB resource example.
Ship: shared model card for YOUR sandbox resource. Next: CSP vs Customer.
4. What you ship: shared model card for $CLOUD_LAB
Three CSP duties, three customer duties, lab resource example. $CLOUD_LAB named. chmod 600.
5. What you record before the next lesson
Date. Shared model card. $CLOUD_LAB named. File t31-m02-l01-shared-model.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Skip customer duties because 'AWS handles security.' Assess stranger tenant to 'test the model.'
- Right: Write shared model card for YOUR $CLOUD_LAB resource. Next: CSP vs Customer.
Mission: map shared model on YOUR sandbox resource
1) Pick one $CLOUD_LAB resource (bucket, VM, or app registration). 2) List three CSP vs three customer duties. 3) Note one common customer failure mode. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
If you cannot name customer duties, your hardening checklist has a blind spot.
APPLY: Shared responsibility means:
APPLY: True or False: Public S3 buckets are typically a customer-side misconfig.
APPLY: Shared model literacy on Cyberlium uses:
CSP vs Customer
Part of Cloud Security with AI — Shared Responsibility.
Misconfig Named
Part of Cloud Security with AI — Shared Responsibility.
Lab — Shared
Part of Cloud Security with AI — Shared Responsibility.